Hi peeps! I dropped the ball on Debian Squeeze security updates and totally hadn't realised that support had ended in May. I'd heard vague murmurings about an extended security support but hadn't realised I'd need to proactively do anything about it. ...so when Shellshock happened I patiently waited my script to tell me that updated packages were available but nothing happened. ...In fact I last got my local-apt report towards the end of July so I guess the security team has been doing some patches for some things anyway? Having done some digging, I think the following entries in /etc/apt/sources.list are appropriate for a Squeeze machine running inside Bitfolk: deb http://apt-cacher.lon.bitfolk.com/debian/ftp.uk.debian.org/debian/ squeeze-lts main contrib (Add non-free if you want). Here are some more tips: https://wiki.debian.org/LTS/Using In particlar check out the section called "Check for unsupported packages" https://www.debian.org/News/2014/20140424 https://wiki.debian.org/LTS Here's some information on the status of the Shellshock vulnerabilities in various Debian versions: https://security-tracker.debian.org/tracker/source-package/bash https://security-tracker.debian.org/tracker/CVE-2014-6277 https://security-tracker.debian.org/tracker/CVE-2014-6271 https://security-tracker.debian.org/tracker/CVE-2014-7169 https://security-tracker.debian.org/tracker/CVE-2014-7186 https://security-tracker.debian.org/tracker/CVE-2014-7187 Now you should be good until Feb 2016. This repository seems to have been pretty laid back in downloading my updates so I guess I'm the first person to hit the cacher with these directories? I also found some old references to test-cacher.lon in there. I guess I can remove those now? Regards, @ndy -- andyjpb(a)ashurst.eu.org http://www.ashurst.eu.org/ 0x7EBA75FF